Reactor Core Damage: Power Excursion

Disaster by Design/Safety by Intent #26 described the accident progression resulting in meltdown of a reactor core. Such scenarios factored in the accidents at Fermi Unit 1 in October 1966, Three Mile Island Unit 2 in March 1979, and Fukushima Daiichi Units 1, 2, and 3 in March 2011.

This commentary describes another less well-known way to damage a reactor core: power excursions.

“Power excursion” sounds like a special kind of outing along the lines of “power lunch,” “power nap,” and “power tie.” It may have such connotations, but in this commentary it refers to the uncontrolled and undesired rapid increase in the power level of a reactor core.

The reactor core contains the fuel powering the nuclear plant’s engine. In most other sources of power, the fuel is metered into the engine on an as-needed basis. For example, an internal combustion engine like that in many horseless carriages has an external fuel tank with gasoline supplied to the pistons depending on how far the gas pedal is depressed. Likewise, the boilers at fossil-fired power stations are supplied coal, oil, or natural gas as needed from outside storage facilities. And even the power generators at hydroelectric dams use some water while most of their fuel (i.e., the lakes) waits patiently nearby.

But reactor cores contain enough nuclear fuel to allow them to operate for 18 to 24 months between refueling outages. It’s like having all the gasoline for a 400-plus mile journey within the pistons and using some means to limit how much of that fuel is burned with each stroke of the pistons. Elaborate and highly reliable means are used to split enough atoms within a reactor core to operate at full power today, while reserving most of the atoms for splitting next week, next month, and even next year.

When the highly reliable control systems fail, too many atoms split. The power level of the reactor core rises uncontrollably. The energy released during the power excursion can damage the reactor as well as its protective containers. As described below, the power excursions at SL-1, Chernobyl, and Tokaimura damaged fuel and killed people.

SL-1 – Arco, Idaho (January 1961)

Three workers worked the night shift on January 3, 1961, preparing to restart the SL-1 boiling water reactor from a two-week outage over the holidays. Their assigned tasks included exercising the control rods in the reactor core to lessen a sticking problem that plagued operation in the past. The workers disconnected each control rod one at a time and manually raised them from the reactor core about four to six inches and then lowered them back to loosen up the travel. Sticking control rods had been experienced over 80 times since the reactor first started up on August 11, 1958.

Fig. 1. (Source: Department of Energy)

About 9 pm, alarms at a nearby facility indicated problems at SL-1. Responders rushed to the site. High radiation levels slowed their passage through the facility. They did not see any one until they reached the doorway into the reactor compartment. They saw two workers down on the floor amid evidence of violence (Fig. 2). One worker was dead; the other was alive but injured badly. The responders rushed the injured worker to a waiting ambulance, but he died en route to the hospital.

Responders located the body of third worker pinned to the ceiling by a control rod ejected from the reactor core. They recovered the bodies of the workers and dismantled the damaged reactor over the next few months.

Fig. 2. (Source: Department of Energy)

The Atomic Energy Commission produced a video describing the accident and the recovery efforts. Because there were no survivors to the accident, the AEC employed CSI Nuclear to figure out what happened.

They determined that the central control rod had been withdrawn about 20 inches from the reactor core. They don’t know why it was withdrawn so far. Some theorized that a worker applied excessive force to a stuck control rod that broke free to travel 20 inches. Others speculate that a worker “goosed” the worker holding the control rod, prompting a reaction that pulled it up too far. And there’s even a grassy knoll conspiracy theory that it was a murder-suicide because the wife of one worker was leaving him to take up with his co-worker.

Whatever the reason for it, withdrawing the control rod that far restarted the nuclear chain reaction within the reactor core. The power level soared to many times the full power level in a fraction of a second. The thermal energy released during the rapid power increase vaporized the water in the reactor vessel. A steam bubble raced upward, shooting control rods out. When the steam bubble hit the top of the reactor, the force lifted the entire reactor vessel and its core up about nine feet before gravity dropped it back into place.

The parts of the SL-1 facility contaminated by the power excursion later made an excursion of a different nature—workers removed them and transported them out into the Idaho desert for burial.

Chernobyl – Ukraine (April 26, 1986)

Workers on the April 25, 1986, night shift on the Unit 4 reactor at the Chernobyl nuclear plant prepared to conduct a special safety test. The reactor was being shut down for a planned maintenance outage. The test called for the operators to manually turn off the turbine/generator. When operating, the large metal blades within the turbine spin at high speeds, cranking the generator connected to the same shaft to make electricity. The test sought to determine how long the turbine spun, even after being turned off, to continue supplying electricity to emergency equipment. The test sought to add an additional layer of safety in the plant’s defense-in-depth defenses.

Workers had reduced the reactor power level to about 50 percent when the dispatcher for the offsite electrical grid called to ask that the shutdown be postponed several hours. Workers resumed the power reduction about nine hours later. The delay affected conditions in the reactor core. To achieve the conditions specified in the test procedure, workers withdrew control rods past allowable limits established in operating procedures. Workers also started two additional water coolant pumps, again contrary to operating procedures. To enable the test to ascertain how an alternate power supply could work, the test procedure had the workers intentionally disable some of the normal safety features.

Early on the morning of April 26 with the reactor power level reduced to about 7 percent of full power, the operators started the test. Because the reactor conditions resulting from the unexpected delay differed significantly from those anticipated when the special test was written and approved, problems were soon encountered. Workers realized that the test was going badly and depressed pushbuttons to halt the test by rapidly inserting the control rods into the reactor core.

Fig. 3. (Source: Nuclear Regulatory Commission)

The workers intended to quickly reduce the reactor power level by terminating the nuclear chain reaction. The abnormal reactor core conditions they established for the test created the exact opposite response. Their actions caused the reactor power level to soar from 7 percent to above 100 percent power in a handful of seconds. The thermal energy released during the power excursion boiled a large amount of cooling water. The expansion of so much water turning into steam triggered a massive steam explosion that literally blew the containment building open (Fig. 4).

Fig. 4. (Source: Jon Block)

Unlike U.S. nuclear plants that use water, Chernobyl used graphite blocks to slow down, or moderate, the high energy neutrons released by atoms splitting in the reactor core to the speeds needed for neutrons to interact with atoms to yield more fissions. The accident ignited the graphite, which burned for about ten days carrying radioactive particles and gases with the smoke high into the atmosphere. Rainfall contaminated regions in the Ukraine many miles from the plant. Large areas around the plant remain heavily contaminated and virtually inaccessible three decades later.

Fig. 5. (Source: Nuclear Regulatory Commission)

Safety by Intent

Just as nuclear power reactors are equipped with an array of diverse and redundant emergency systems to prevent reactor core meltdowns such as those described in Disaster by Design/Safety by Intent #26, the reactors have protection against reactivity excursions.

To guard against a repeat of the SL-1 accident, reactor cores at U.S. nuclear plants are designed to be shut down even if the most powerful control rod remains fully withdrawn. A combination of design features and administrative controls further restricts how fast the reactor’s power level is increased. And the reactor protection system will automatically shut down a reactor within seconds if the power level increases too rapidly. Fission Stories #59 described how this system stepped in and rapidly shut down the Pilgrim reactor after operators failed to properly control the startup rate.

But Chernobyl had design features guarding against reactivity excursions. Workers disabled those features in order to conduct the safety test.

And SL-1 had administrative controls guarding against reactivity excursions. Workers, for reasons unknown because none survived to explain why, violated those measures during safety repairs.

Letting the safety guard down invites disaster. And we’ve already accumulated too many reminders that disaster sometimes accepts the invitation.

—–

UCS’s Disaster by Design/Safety by Intent series of blog posts is intended to help readers understand how a seemingly unrelated assortment of minor problems can coalesce to cause disaster and how effective defense-in-depth can lessen both the number of pre-existing problems and the chances they team up.

Support from UCS members make work like this possible. Will you join us? Help UCS advance independent science for a healthy environment and a safer world.

Show Comments

Comment Policy

UCS welcomes comments that foster civil conversation and debate. To help maintain a healthy, respectful discussion, please focus comments on the issues, topics, and facts at hand, and refrain from personal attacks. Posts that are commercial, self-promotional, obscene, rude, or disruptive will be removed.

Please note that comments are open for two weeks following each blog post. UCS respects your privacy and will not display, lend, or sell your email address for any reason.

nikkkom

“The expansion of so much water turning into steam triggered a massive steam explosion that literally blew the containment building open”

RBMK reactors have no containment building. Their “reactor hall” building is not designed to contain anything.

The Department of Energy would like you to think the accident was caused by an emotionally unstable operator even though a congressional review board absolved to crew. The SL-1 reactor was poorly designed, used poor materials selection, poor fabrication, had an inadequate safety analysis, and had numerous safety rod sticking occurrences. Add to this rapidly deteriorating reactor, testing at high power levels to test a new condenser design. Test plans were exceeding power limits of the reactor and swinging pens off of chart recorders. No wonder one of the crew commented that he feared the reactor was going to blow up. The final manual lift to free 80-lb stuck safety rod likely stuck at a weld discontinuity as it was proven after the accident that an overlift could easily occur and result in the prompt critical condition.

The DOE ruled prior to material investigation that rod sticking played no role in the accident. They emphasized that the pulled rod performed better than the other rods. But they failed to describe the numerous times the center rod had stuck or the opportunity for additional material deformation and swelling following the recent runs at high power. The DOE also doesn’t tell people that the accidental rapid withdrawal of the center rod which was never mentioned or analyzed in its safety analysis of SL-1 was 10 times worse because of the cold water in the vessel that January night, delaying heat transfer from the fuel. In fact, accident investigators never knew the vessel had jumped to the ceiling until they went to cut piping to remove the vessel and found the piping sheared by the accident. There was virtually no way for a crewman to expect he could cause the prompt criticality and steam explosion that would kill all three of the crew.

n_coast

As an engineer with experience analyzing reactor structures and heat transfer, I don’t understand your sentence about water temperature. Colder water would mean a higher convective heat transfer rate, but it would also increase the moderation rate — how quickly neutrons would be slowed to facilitate capture by the U235 nuclei. I guess it could result in a faster excursion. The critical technology would be reactor kinetics rather than heat transfer. I didn’t find this covered in your article, but my time is a bit rushed by tax preparations. The Wikipedia post on the accident is helpful.

I could understand that a test facility or prototype may be designed to lower standards than a power generating station. (How redundant were the safety provisions at Stagg Field?) I’m having trouble understanding why some sort of mechanical jack wasn’t provided to pull the control rod. (What was the radiation exposure of the operator when he was bent over the control rod?)

Tami Thatcher

Thank you for reading more deeply. You now know 100 times more than most authors who regurgitate the “we will never know what caused the accident.” The thing is film boiling. When water is subcooled, it takes longer to reach film boiling which gives much greater heat transfer. The highly subcooled water in the reactor vessel tank took longer to reach film boiling and allowed the fuel to over heat. In fact, the famous BORAX boiling reactor tests that concluded that the boiling water reactor is inherently safe – as long as fuel and coolant heat transfer is adequate – these tests increased the challenge of the test by lowering the temperature of water in the tank.

Your question “why didn’t some sort of mechanical jack to limit the pull height of the control rod” is RIGHT ON POINT. Exactly! Actually, they were planning to upgrade the mechanism, mostly because of the multiple heavy – 80 lb lifts. But the experts really did not appreciate what could happen at SL-1 during shutdown when the center rod, the highest reactivity worth rod, was lifted. It was not analyzed. Not until AFTER the accident, when they were wondering if a chemical bomb had been set. Honestly, the experts did not know what the hec had happened, and bomb experts were hired. But they concluded that, gee, an average person could easily over lift the rod and it was fast enough to cause a prompt criticaility with one oopsy. This was a 20 below zero January night after a holiday in the evening shift with 3 crewman facing an evening of a tremendous work load — and trying to get a rod that won’t move, to just come up so the clap can be removed.

The tragedy of those three men is compounded by the false blame being placed on a man whose hands, based on autopsy, were not on the rod.

Tami Thatcher

The Department of Energy contractors tried to decontaminate the bodies of the SL-1 crewmen. They soaked. They scrubbed. But the steam infused with radioactive particles soaked into the skin in a way that could not be reversed. So in order to allow for the bodies to be placed in caskets and buried in cemeteries, the hottest body parts (some exceeding 500 rem/hr) were chopped off and buried at the Idaho National Laboratory’s Radioactive Waste Management Complex. This included head, hands, as needed to lower the radioactivity of the lead-lined caskets to allow their transport and burial. One famous book misidentifies the body radiation descriptions (sketches) and crewmen. Autopsy was performed, evaluating radiation levels and the status of body organs. The crewman who lifted the rod was impaled by another rod and basically skewered to the ceiling with a twisting rod entering at lower hip and exiting at the diagonal shoulder. The only identifiable organs that could be examined were gonads. And from what I gather, that examination showed some degree of excessive radiation exposure had occurred during routine operations moving fuel etc. at the facility.

The routine exposures at SL-1 were problematic. Power operations were being conducted without the kind of consideration of core status and reactivity analysis (deviation from expected rod withdrawal distance to achieve normal planned criticality) that would be expected at a well-designed facility. The analysis and scrutiny of changes in material status of this reactor should have been more rigorous, not less, than at a well-designed reactor.

The fact that there were only 3 men there and funding for additional staff was denied by DOE is significant. The emergency responders arrived to a locked gate and had no one to tell them where the crewmen were. Were they off having cake at a neighboring facility? The fireman arrived and had no idea that a reactor accident had occurred. One crewman was doomed still alive, but this was not discovered until over an hour after emergency responders arrived. Fireman got radiation doses before they even determined they should get a radiation detector out of the firetruck. Then they assumed that the radiation detector was malfunctioning when it pegged.

The radioactive fallout, it was said, was basically limited to Iodine-131. Fascinating. No reactor before or since has been able to melt fuel yet only release Iodine-131 which decays away in a few months.

The reactor building would be demantled but ajoining buildings remained in use until the 1980s when monitoring determined that the buildings were so contaminated that they could not be remediated. So, what of the workers in those remaining building for two decades? They are told by NIOSH that the DOE always carefully monitored radiation and planned work. So, the workers cancers cannot be caused by working in the contaminated buildings that DOE claimed were not contaminated all those years.

The DOE had to deflect blame for the accident from its decisions in overseeing safety and deflect blame from contractors interested in providing nuclear power components. The DOE did not want anything said that would undermine public confidence in nuclear energy. Do you understand, now, why the public has been systematically lied to about the cause of the SL-1 accident?

Tami Thatcher

The SL-1 reactor accident occurred during a routine outage as a control rod was being reconnected to the drive mechanism. When the control rods were resting in the disconnected position, they were 4 inches lower than the normal “zero position” of the connected configuration. In order to connect a control rod to the drive mechanism, it had to be lifted up about 4 inches and c-clamped in place. A slight lift was needed after the 4-inch lift. This height of the second adjusting lift prior to removal of the c-clamp was not specified in the work procedure, nor was any particular hazard warned of. So while clearly there was no mechanical approach to preventing the excess rod withdrawal, it is actually a stretch to say the work procedure for reconnecting the drives contained an administrative control. Typically an administrative control is a specific limit to be adhered to that addresses a documented hazard. Prompt criticality during shutdown due to the movement of a single rod was not an analyzed hazard in the safety documentation for the SL-1. There was no analysis to identify the amount of overlift that could result in a prompt criticality. A crewman could have expected it to raise neutron activity but not to have caused a prompt criticality.

And I cannot overstress the importance of understanding that part of the control rod extended below the core, and the rod had weld discontinuities in the lower portion of the rod. The material deterioration in the reactor was rapidly accelerating the swelling and deformation of materials. The initial 4 inch lift of the rod did not mean the rod would not encounter sticking at a slightly higher position as it encountered weld discontinuities or other material interference. The control rods had in fact stuck at this position in the past.

The continued denial by the Department of Energy that sticking played no role in the accident is nothing but propaganda. Try grasping a vertical rod about 2 ft above your feet and trying to free an 80-lb object – I’ve tried to bend over and move irrigation head gates that are slightly stuck and you end up feeling like your back is going to break.
So as the crewman tried to raise the stuck 80-lb rod just a wee bit higher and it doesn’t budge, he has to try harder. Every operator who has worked over a similar reactor tank understands that the rod was stuck and it was yanked on and over lifted. And because of the raised initial position while c-clamped, only about 16 inches of travel remained with the reactor going prompt critical prior to the final rod withdrawal position. There was no time to correct the overlift – it was all over. And there was no documented precaution about a shutdown accident of prompt criticality from a single rod being moved. After the accident, the reactor experts were stymied as to what exactly had happened and had to figure out if a single rod being moved could actually cause the reactor excursion.

Many reports incorrectly state the amount of rod withdrawal. Early reports of the investigation focused on the distance that the upper portion of the rod had moved and it was moved farther that the manual lift because of the subsequent steam explosion and vessel jump. Stories of the rod pulled completely out of the core region continue to cloud the fact of the initial position of the disconnected rod, its interim position raised and held by the c-clamp, and the manual amount of overlift (about 16 inches).

I apologize for the many posts. But I still here DOE repeating the refrain that we will never know why the crewman lifted the rod too far. The Department of Energy wanted to avoid accepting blame for the shoddy safety analysis and the poorly designed reactor. The contractor and reactor designer also wanted to avoid being blamed for the horrific accident. Unfortunately, much of the deliberate misinformation about the SL-1 accident lives on, enshrined in nuclear text books.